Self-service

The IRS enforces a strict password policy for its 130,000 desktop systems nationwide.Passwords must be at least six characters long'with at least one numeral and one symbol'and changed every 90 days. Users must not write them down. The tax agency maintains a six-generation history to prevent frequent reuse.That means a lot of workers forget their passwords.'You have to make a choice between security and user friendliness,' said Jim Kennedy, program manager for IRS enterprise system management.But it's more than minor unfriendliness when a worker gets locked out for not remembering a brand-new password, or mistyping it three times in a row.Kennedy estimated that about 35 percent of calls to the IRS help desk are for lockouts and password resets. Of the 410,000 IRS help desk calls since October 2002, nearly 150,000 were for password problems, costing the agency about $2 million.On top of that is lost productivity. 'The shortest amount of time in which we could unlock a workstation was several hours,' Kennedy said. So when IRS consolidated its 36 regional help desks to one central desk last year, it looked for a better way to handle passwords.'We wanted self-service password resets with strong authentication,' Kennedy said.The agency settled on Password Courier from Courion Corp. of Framingham, Mass. Courion's products manage passwords, accounts, certificates and user profiles across an enterprise.'We stole a lot of our ideas from the automated teller machine,' which links a variety of banking services across large networks, marketing vice president Tom Rose said. The client side authenticates users through either a Web site, a pop-up window or an interactive voice-response telephone system. Users must answer up to five personal questions correctly before they can reset a forgotten password. The same procedure can synchronize passwords for multiple systems.At the server end, password management modules connect with corporate directories or databases to verify identity. They can enforce password policy across Microsoft Windows, Unix, mainframe or Novell NetWare networks. They work with help desk software to open, assign, update and close trouble tickets.The Password Courier server needs a 700-MHz processor, Microsoft Windows NT 4.0 or Windows 2000 Server, 256M of memory and 100M of free storage. All links with the password management modules can be encrypted.Courion produced its first password management products in 1996, but the technology has been slow to catch on.'The first reaction was, 'That's not secure,' ' Rose said. The next reaction was that single sign-ons would ease password headaches, but single sign-on proved to be more complex to engineer than expected. Although it can reduce the number of passwords each user needs, that does not eliminate the chore of managing them.'It's taken off only in the last two or three years,' Rose said.Password Courier servers can be clustered for load balancing. The number of servers needed for an enterprise depends on the amount of activity. IRS is using two Windows NT platforms at its Detroit computing center.The servers also run IRS' help desk software, Peregrine Service Center from Peregrine Systems Inc. of San Diego, to open and close trouble tickets and track use.To access the password service, a user enters a log-in name and domain and answers three questions: the name of a childhood friend, a significant date other than a birthday or anniversary, and a significant telephone number other than home or office number.Users who give three wrong answers get locked out, requiring a call to the service desk.Kennedy said the authentication process has significantly stronger security than the last four digits of a Social Security number, which are required for calls to the IRS service desk.A limited implementation of Password Courier last year had a Web interface, but any user who forgot a password had to go to a neighboring computer to borrow the Web browser.'Our security organization didn't like that,' Kennedy said. IRS policy prohibits an employee from using a computer where someone else is signed on.So IRS is moving to the Password Courier Direct interface, which presents a pop-up box for resetting a password before the log-in screen opens.'If you lock up your machine, up pops a window that asks, 'Do you need to reset your password?' ' Kennedy said.The Direct interface asks the same authentication questions as the Web interface. It requires a 1M piece of client software, and 'we'll push that out [to clients] using our software automation tool,' Kennedy said.Although Password Courier registration halted during the switch to the new interface, more than 15,000 users have now registered. Kennedy also wants to synchronize passwords for multiple accounts.'I have eight different log-ins,' he said.It's too early to say whether users are forgetting their passwords less often, but during the six weeks the Web interface was up, about 18,000 passwords were reset.'I'm guessing we won't know the full impact until August or so,' Kennedy said, but he is confident it's worthwhile: 'For 100,000 clients, [Password Courier Direct] costs $200,000. That is incredibly cost-effective. We'll get the return on that in way less than a year.'(Revised July 9 and July 28, 2003)